Object-level authorization failures happen when an API trusts a user identity but does not verify ownership or access policy for each specific object requested. Attackers enumerate identifiers in paths, query strings, or payloads to access neighboring tenant or account data. The risk expands in microservice systems where one service assumes another already checked access, resulting in inconsistent enforcement and silent data exposure across endpoints.
Enforce authorization at the object boundary on every read, write, and delete operation. Use centralized policy checks and require explicit ownership or entitlement validation before data access. Add negative tests for ID tampering, include tenant-scoped identifiers, and monitor repeated object-ID probing to detect enumeration attempts early.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2019Latest
#01api01-2019 Broken Object Level Authorization
